Static task
static1
Behavioral task
behavioral1
Sample
f81c9747fd8fb1e4de583c8172f2922dcb9b4912e245a68ab7bc802ad2f394e9.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
f81c9747fd8fb1e4de583c8172f2922dcb9b4912e245a68ab7bc802ad2f394e9.exe
Resource
win10v2004-20230621-en
General
-
Target
f81c9747fd8fb1e4de583c8172f2922dcb9b4912e245a68ab7bc802ad2f394e9
-
Size
3.8MB
-
MD5
0ee899aaab409bd242f48bf0f0f586e9
-
SHA1
61d792d7901f6a9ff285b963390b8334d40da4d5
-
SHA256
f81c9747fd8fb1e4de583c8172f2922dcb9b4912e245a68ab7bc802ad2f394e9
-
SHA512
be9da595038a9e742654f0dafe531a2ea00ee277c64560b6a2c03b45f69c1b56b0cd3a36eee80a70963ca22e5fbc9d5da588b6ed84fbcb1db0a125b30d8bd7c4
-
SSDEEP
24576:4Ht/x0BayP8JqwD4nWR+0aEXio+dgXGGR4xMp4RqY23NdZEj:4TyP+q5WR+0a/HlxMu4o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f81c9747fd8fb1e4de583c8172f2922dcb9b4912e245a68ab7bc802ad2f394e9
Files
-
f81c9747fd8fb1e4de583c8172f2922dcb9b4912e245a68ab7bc802ad2f394e9.exe windows x86
414dd7492c0be530e074e8cedbe540d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
GetEnvironmentVariableA
FindFirstFileA
GetProcAddress
VirtualAlloc
CopyFileA
FindClose
LoadLibraryA
Process32Next
GlobalMemoryStatusEx
GetModuleFileNameA
FindNextFileA
CreateToolhelp32Snapshot
CloseHandle
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
GetConsoleWindow
lstrcpynA
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetTickCount
GetModuleHandleA
FreeConsole
AllocConsole
SetConsoleCtrlHandler
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
LockResource
GlobalAlloc
GlobalReAlloc
GlobalFree
ReadFile
CreateDirectoryW
GetLastError
EncodePointer
DecodePointer
GetFileAttributesExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
HeapAlloc
GetDriveTypeW
GetFullPathNameA
GetSystemTimeAsFileTime
GetModuleHandleExW
AreFileApisANSI
GetCommandLineA
RaiseException
Process32First
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
HeapSize
SetLastError
InterlockedIncrement
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
CreateFileW
GetProcessHeap
GetCurrentDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
GetFileType
InitOnceExecuteOnce
QueryPerformanceCounter
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetConsoleCP
SetFilePointerEx
HeapReAlloc
OutputDebugStringW
LoadLibraryW
CompareStringEx
LCMapStringEx
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetExitCodeProcess
CreateProcessA
SetEndOfFile
ReadConsoleW
SetEnvironmentVariableA
lstrlenA
LocalFree
InterlockedDecrement
ExitProcess
GetLocalTime
RtlUnwind
Sleep
user32
ValidateRect
GetWindowRect
AdjustWindowRectEx
ScreenToClient
LoadCursorA
DestroyIcon
IsWindowVisible
ReleaseDC
SendMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
GetForegroundWindow
SetWindowPos
DestroyWindow
CreateWindowExA
GetAsyncKeyState
GetDC
RegisterClassExA
UnregisterClassA
PostQuitMessage
DefWindowProcA
DrawTextA
ShowWindow
PostMessageA
advapi32
OpenProcessToken
GetLengthSid
ole32
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
shell32
ExtractIconA
oleaut32
SysFreeString
VariantInit
VariantClear
SysAllocString
ws2_32
socket
recv
WSACleanup
htons
inet_addr
WSAStartup
connect
send
closesocket
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ